ISC2 Systems Security Certified Practitioner (SSCP) Practice Question

Non-repudiation requires proof of origin and integrity that the sender cannot later dispute. A digital signature created with the sender's private key binds the signer's identity to the specific message hash; anyone with the corresponding public key can verify the signature at any time, detecting any alteration and proving who signed it. Symmetric encryption protects confidentiality but offers no verifiable link to a unique individual because the key is shared. Storing only a hash ensures integrity but carries no proof of authorship. Server-side timestamps show when a message passed through infrastructure, not who genuinely approved it, and they can be spoofed or challenged. Therefore, digitally signing each approval email with the sender's private key is the most effective way to achieve non-repudiation.